Friday, February 26, 2016

Malicious Excel File

Around 7:30amCST an Excel Spreadsheet w/macro began propagating across the Internet.  If you trust your security to the Anti Virus Vendors, you're likely sipping on a cup of coffee expecting to have an easy day heading into the weekend... as neither McAfee nor Symantec are currently detecting a problem:


However, per this Forcepoint File Sandbox Report, your day is about to change as this file is indeed malicious.  Per the report, it attempts to modify 21 Files, 2 Processes and 412 Registry Entries.  If that isn't bad enough, this Dropper File will also communicate to sites in Russia and Vietnam to pull down additional malware:


Additionally, if you've entrusted your Web Security to Cisco Ironport and are hoping the phone home to uggs-fashion.ru is blocked... you'll be disappointed.  Per below, the site name implies it's a fashion site, and, the Senderbase Reputation System unfortunately agrees:


In summary, security is moving far too fast to rely upon AV Signatures.  Contact ESPO Systems for a free consultation regarding how you can protect your IT Assets across the entire Kill Chain.

2 comments:

  1. This is my first time i visit here. I found so many interesting stuff in your blog especially its discussion. From the tons of comments on your articles, I guess I am not the only one having all the enjoyment here! keep up the good work
    excel vba training london

    ReplyDelete
  2. “You really know your stuff... Keep up the good work!”
    kathleen brooks forex

    ReplyDelete